Improve this doc  View Source

$sceDelegateProvider

  1. - $sceDelegate
  2. - provider in module ng

The $sceDelegateProvider provider allows developers to configure the $sceDelegate service. This allows one to get/set the whitelists and blacklists used to ensure that the URLs used for sourcing Angular templates are safe. Refer $sceDelegateProvider.resourceUrlWhitelist and $sceDelegateProvider.resourceUrlBlacklist

For the general details about this service in Angular, read the main page for Strict Contextual Escaping (SCE).

Example: Consider the following case.

Here is what a secure configuration for this scenario might look like:

 angular.module('myApp', []).config(function($sceDelegateProvider) {
   $sceDelegateProvider.resourceUrlWhitelist([
     // Allow same origin resource loads.
     'self',
     // Allow loading from our assets domain.  Notice the difference between * and **.
     'http://srv*.assets.example.com/**'
   ]);

   // The blacklist overrides the whitelist so the open redirect here is blocked.
   $sceDelegateProvider.resourceUrlBlacklist([
     'http://myapp.example.com/clickThru**'
   ]);
 });

Methods